Stories by: Steve Hultquist

The wide variety of so-called NAC (network access control) products on the market shows a broad range of thinking about policy-based security controls and the management of the network in general, including the end-point devices that connect to the network. Some vendors enforce policies using a client agent, some enforce them in the network, and some even use peers for enforcement. Network-based enforcement itself can take many forms, including dedicated gateway, DHCP manipulation, 802.1x authentication, and port- and VLAN-based enforcement on switches.

Just this week while I was on-site, an IT services company serving a client of mine asked for my help. They needed to know where to put their efforts in securing information. Their customers are varied, with a range of systems and connectivity. For each infrastructure, they wanted to know, where are the highest risks? In one case, there are two connections to the Internet, remote access, mobile users, and a complex web of systems and networks, some with external data sharing.

Traditionally, many IT specialists have seen networks as an open channel. They allow an infinite variety of devices to communicate, and the best networks make communication simple, free, and instantaneous -- like the air we breathe. Back in the early days of the Internet, shell accounts were free for the asking. Few people used passwords. It was an easy and altruistic era.

Late at night, a system administrator performed a routine check of a crashed server, one of 48 systems comprising a major online infrastructure that generated about US$4 million per month in revenue. He was a bit surprised that the system had gone down, as it had been humming for months without any indication of being prone to crashing. The check uncovered three encrypted files. The administrator called on MANDIANT to analyse them.